The Morris Worm: The Night the Internet Got Sick
On November 2, 1988, a 22-year-old grad student released a program to quietly measure the early internet. By morning it had knocked thousands of machines offline. One bad line of logic made the difference.
At around 8:30 on a Wednesday night in November 1988, a program started running on a computer at Massachusetts Institute of Technology (MIT). Nobody at MIT had launched it. It copied itself to another machine, then another, then another. It didn't delete files or steal anything. It just kept spreading.
By the next morning, computers at universities, National Aeronautics and Space Administration (NASA) research centers, and military research labs across the United States had slowed to a crawl or stopped responding entirely. System administrators who'd gone home for the night came back to machines buried under hundreds of copies of the same mystery process. Some pulled their networks off the internet completely, cutting themselves off from the very people trying to figure out what was happening.
It was the first time the internet, then a network of maybe 60,000 machines run mostly by researchers who trusted each other, had been hit by something that spread on its own. It became known as the Morris Worm, and almost every security concept you'll study for A+ and Security+ shows up somewhere in this story.
Illustration of what an admin might have seen the next morning: hundreds of processes and a load average far above what a lightly loaded machine would show; compare load with its Central Processing Unit (CPU) count. The worm named its process sh to blend in.
Who wrote it, and why
Robert Tappan Morris was a 22-year-old first-year graduate student in computer science at Cornell (he turned 23 six days later). His father, Robert Morris Sr., was a well-known Unix pioneer and at the time the chief scientist at the National Security Agency's National Computer Security Center. Security ran in the family.
By his own account the worm was an experiment: a way to find out how big the internet actually was by having a program visit as many machines as it could. It wasn't designed to destroy anything. He launched it from a computer at MIT rather than Cornell, which made it harder to trace back to him.
To spread, it needed a way into each new machine. It had four.
Four ways in
Pick a door the worm used
Each one is a lesson that still shows up on your exams, usually under a different name.
The bug that broke the internet
Morris knew a program that kept reinfecting the same machine would get noticed. So before installing itself, the worm asked the machine, "Is a copy of me already running here?" If the answer was yes, it was supposed to back off.
But he worried administrators would simply fake that answer to protect their machines. So he added an exception: one time in seven, the worm would install itself anyway, even if a copy was already running.
One in seven sounds small. But every copy was also trying to infect its neighbors, over and over, all night. On a network where machines constantly reached each other, one in seven was enough to stack dozens and then hundreds of copies on the same computer. Each copy ate memory and processor time until the machine couldn't do anything else. What was meant to be invisible became a denial of service against the whole internet.
Release it yourself
Simplified model: illustrative topology and timing. These fifty machines and their connections, simulation clock, and unusable threshold do not reconstruct the historical network. Compare a one-in-seven reinfection chance with always backing off to see how repeat infections can amplify load.
Press Release the worm. It starts on one machine, just like it started on one computer at MIT.
The night, hour by hour
The worm is released from a computer at MIT and starts copying itself across the network.
Machines at universities and research labs start slowing down. Admins find dozens of unfamiliar sh processes. Killing them doesn't help; new copies keep arriving.
Morris realizes it's out of control. At his request, a friend at Harvard posts an anonymous warning with instructions to stop it. The message crawls across the jammed network and arrives too late to help most sites.
Many sites disconnect from the internet entirely. Email, the main way admins coordinate, is part of what's broken.
Teams at UC Berkeley and MIT capture copies and reverse-engineer the code. Within about a day they publish what it does and how to block each of its four ways in.
Defense Advanced Research Projects Agency (DARPA) funds the Computer Emergency Response Team Coordination Center (CERT/CC) at Carnegie Mellon, a permanent group to coordinate the response to the next attack.
Morris is indicted and becomes the first person convicted under the 1986 Computer Fraud and Abuse Act. His sentence: three years of probation, 400 hours of community service, and a $10,050 fine.
Morris went on to co-found the startup Viaweb and later Y Combinator, and became a professor at MIT. The worm's source code on a floppy disk ended up in a museum.
What it changed
Incident response became a discipline. Before November 1988, there was no one to call. CERT/CC was the first coordinated response team, and today's Computer Security Incident Response Teams (CSIRTs), Security Operations Centers (SOCs), and incident response plans trace back to it. When Security+ walks you through preparation, detection, analysis, containment, eradication, recovery, and lessons learned, that process was built because of nights like this one.
Trust became something you verify. The worm hopped between machines that trusted each other by default. The modern answer to that is Zero Trust: no device or network location is trusted just because of where it sits.
Hacking became a crime with a precedent. The Morris case established how courts would apply computer crime law to code that spreads on its own, whatever the author intended.
Where this shows up on your exam
A worm self-replicates across a network with no user action. Know how that differs from a virus, Trojan, and rootkit.
The password guessing was a dictionary attack. Its traffic flood made it a denial of service in practice.
Password hashes now live in /etc/shadow, readable only by root. In 1988 they sat in /etc/passwd where anyone could read them.
The fingerd attack is the textbook buffer overflow. The sendmail hole was a misconfiguration.
Hundreds of copies of one process and machines grinding to a halt: resource consumption as an indicator of malicious activity.
The trusted-host hop is why Zero Trust removes implicit trust zones.
CERT/CC, reverse engineering the sample, and publishing fixes: analysis, containment, eradication, lessons learned.
Spot the exam term
Watch it
Want more of the story? These free videos go deeper. They open on YouTube in a new tab.
Brett went from food service to Information Technology (IT) in 2020 and earned his certifications from scratch. He builds BB Tech Tools to close a gap every IT learner hits: knowing the concepts but freezing on Performance-Based Questions (PBQs).
Sources. Eugene Spafford, "The Internet Worm Program: An Analysis" (Purdue, 1988); Mark Eichin and Jon Rochlis, "With Microscope and Tweezers" (MIT, 1989); U.S. General Accounting Office report Government Accountability Office (GAO)/IMTEC-89-57 (1989); United States v. Morris, 928 F.2d 504 (2d Cir. 1991).